Crossplane: Infrastructure Automation Ledger 2026 Scorecard

Part of the Infrastructure Automation Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: community project (CNCF Graduated), created and primarily maintained by Upbound
Owner: Cloud Native Computing Foundation; CNCF Sandbox 2020-06-25, Incubating 2021-09-14, Graduated 2025-10-28 (announced 2025-11-06). Upbound, Inc. (Seattle, venture backed, $69 million raised) is the creator and primary maintainer
Engine: the project is the engine; Upbound Crossplane (UXP) is a drop-in distribution
Licence: Apache 2.0 with no change found. Upbound editions (2026-10-15): Community free, Standard from $1,000 a month (up to 5 control planes), Enterprise and Business Critical custom; self-hosted Space only on Business Critical
Latest release: v2.4.2 (2026-09-22); v2.4.0 (2026-08-20); v1.20.13 (2026-09-15) on the last v1 series
Support lifecycle: A release every 13 weeks; the three newest minors maintained for nine months each, best effort with no response SLA; v2.4 to May 2027, v2.3 to February 2027, v2.2 and v1.20 to November 2026; upgrade to v2 from v1.20
Next milestone: v2.5 in November 2026 (published calendar runs to v2.7 in May 2027)
Targets: vSphere: stuttgart-things/provider-vspherevm, community, Upjet-generated, v0.8.1 (2026-06-13). Proxmox VE: valkiriaaquatica/provider-proxmox-bpg, community, v1.21.0 (2026-10-09). Nutanix: mgeorge67701/provider-nutanix, community, v0.2.9 on the Upbound Marketplace, release date not found. Hyper-V and XCP-ng: no provider found. KubeVirt: no dedicated provider; since v2.0 a composition can include any Kubernetes resource, including VirtualMachine objects. Clouds through Upbound Official Providers (gated) and crossplane-contrib
Tier: Infrastructure-as-code engine
Archetype: Dependable builder
Evidence grade: B. The release cycle page, the README release table, the v1.0, v1.17, v1.20, v2.0 and v2.4 release notes, the licence, the CNCF project page and Upbound's provider policy posts were read as primary sources. The contents of v2.1 to v2.3 were read only in part, and the years of pre-2025 releases are inferred from release pages that show day and month only (grade B). Upbound's AI claims and the first release date are unverified (grade C).

Scope of the scores: The scores cover the open source engine as a community project. Upbound's commercial distribution (UXP, Spaces, Marketplace) is described where it changes what a user can download; since 2025-03-25 Upbound's Official Providers are free only in their latest version and, from UXP 2.0, run only on UXP.

Scorecard

Dimension	Score	Direction
Capability today	50.1 / 100	higher is better
Momentum since end of 2022	+17.5 points (2018 to 2022: +18.2)	higher is better
Credibility	20.0 / 25	higher is better
Sustainability risk	9.0 / 25	lower is better
Technical lock-in	11.5 / 25	lower is better
Integrator fit	13.0 / 20	higher is better
AI leverage	2.0 / 20	higher is better
Ledger Index	57.2 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Provisioning breadth (15)	n/a	1	2	2.5
Configuration management depth (12)	n/a	0	0	1
State, planning and safety (12)	n/a	1	2	3
Language and authoring (10)	n/a	1	2	3.5
Orchestration and self-service (10)	n/a	1	2.5	4
Scale and control plane (8)	n/a	1	2.5	3.5
Security and compliance (10)	n/a	0.5	2	3
Bare metal and day-2 operations (8)	n/a	0.5	0.5	0.5
Ecosystem and integrations (8)	n/a	1	2.5	3.5
AI assistance (7)	n/a	0	0	0
Total / 100	n/a	14.4	32.6	50.1

Year by year: 2018: 14.4 · 2019: 14.4 · 2020: 31.8 · 2021: 32.6 · 2022: 32.6 · 2023: 32.6 · 2024: 36.8 · 2025: 46.1 · 2026: 50.1

What moved the score

Year	Domain	Change	Points	Trigger
2020	Ecosystem and integrations	1 → 2	+1.6	CNCF Sandbox (2020-06-25)
2020	Language and authoring	1 → 2	+2.0	1.0: XRDs and Compositions as v1 APIs
2020	Orchestration and self-service	1 → 2.5	+3.0	1.0: Compositions as the self-service model behind a Kubernetes API
2020	Provisioning breadth	1 → 2	+3.0	1.0: provider APIs declared v1 with a stability commitment
2020	Scale and control plane	1 → 2.5	+2.4	1.0 on a highly available Kubernetes control plane
2020	Security and compliance	0.5 → 2	+3.0	1.0: Kubernetes RBAC and audit apply to every object
2020	State, planning and safety	1 → 2	+2.4	1.0: continuous reconciliation of managed resources repairs drift
2021	Ecosystem and integrations	2 → 2.5	+0.8	CNCF Incubating (2021-09-14)
2024	Language and authoring	2 → 3	+2.0	1.17: composition functions v1, native patch and transform deprecated
2024	Orchestration and self-service	2.5 → 3	+1.0	1.17: function pipelines GA
2024	State, planning and safety	2 → 2.5	+1.2	1.17: render and xpkg init GA for local checks
2025	Configuration management depth	0 → 1	+2.4	2.0: Operation type for one-off, scheduled and event-driven tasks; no OS configuration
2025	Ecosystem and integrations	2.5 → 3.5	+1.6	CNCF Graduated (2025-10-28); 1.20: default registry xpkg.crossplane.io; 2.0 composes any Kubernetes resource
2025	Orchestration and self-service	3 → 4	+2.0	2.0: namespaced composite resources; Operation type for scheduled and event-driven tasks
2025	Provisioning breadth	2 → 2.5	+1.5	2.0: compositions can include any Kubernetes resource; community providers for vSphere, Proxmox VE and Nutanix
2025	Scale and control plane	2.5 → 3	+0.8	2.0: managed resource filtering limits installed CRDs
2025	Security and compliance	2 → 2.5	+1.0	CNCF graduation: two security audits; signed packages and SBOMs for official packages
2026	Language and authoring	3 → 3.5	+1.0	2.3: render against the real reconciler as test tooling; 2.2: pipeline inspector (alpha)
2026	Scale and control plane	3 → 3.5	+0.8	2.4: safe-start providers scale to zero; crossplane-runtime 2.4 client caching cuts provider memory (vendor figure 80 percent)
2026	Security and compliance	2.5 → 3	+1.0	2.4: garbage collector deletes only resources owned by the composite; scannable images
2026	State, planning and safety	2.5 → 3	+1.2	2.3: render runs the real reconciler; 2.4: realtime reconciliation when required resources change; no plan or diff preview

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-01	1.11: composition functions, alpha	Language	V
2023-09	Upbound contributes control plane provider technology to Crossplane under the CNCF	Ecosystem	P
2023-11	1.14: composition functions, beta	Language	V
2024-08	1.17: composition functions v1, render and xpkg init GA, native patch and transform deprecated	Language	V
2025-01	Upbound Official Providers: free only in the latest version from 2025-03-25	Packaging	P
2025-05	1.20: default registry xpkg.crossplane.io, realtime compositions beta	Ecosystem	C
2025-08	2.0: namespaced composite and managed resources, compositions of any Kubernetes resource, Operations	Orchestration	C
2025-08	UXP 2.0: Official Providers run only on Upbound's distribution	Packaging	P
2025-11	CNCF graduation announced	Ecosystem	V
2026-02	2.2: ImageConfig for packages, pipeline inspector alpha	Language	C
2026-03	function-kro: YAML plus CEL composition	Language	V
2026-05	2.3: render runs the real reconciler, provider deletion protection alpha	State and planning	C
2026-08	2.4: realtime reconciliation on required resources, scale-to-zero providers, garbage collector hardening, CLI renamed	Scale	C
2026-08	Upbound v3: Hub, Console, fleet-wide identity, self-hosted and air-gapped platform	Scale	P
2026-10	New Crossplane CLI developer experience announced; crossplane-runtime 2.4 memory reduction	Language	C

Centre of gravity: Language (6), Ecosystem (3), Packaging (2)
Blind spots (no items): Provisioning breadth, Configuration management, Security, Bare metal, AI, Licensing
Driver mix: Vision 33%, Customer need 40%, Market window 0%, Upstream 0%, Portfolio 27%
Idea-to-need index: 0.45 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 20.0 / 25

Criterion	Score	Basis
Cadence	5	Published 13-week cycle with a calendar to May 2027; v2.2, v2.3 and v2.4 shipped on their dates
Roadmap transparency	4	Public release calendar, open repository and release notes; the feature roadmap was not read
Say-do	4	Release dates held through 2026; composition functions went alpha to v1 in 19 months; Upbound's AI items have no stated status
Velocity	4	Several capabilities in 2.0 and 2.4; 2.2 and 2.3 content read only in part
Lifecycle stability	3	Nine months per minor, three supported; v1 to v2 upgrade only from v1.20; CLI renamed in 2.4; native patch and transform deprecated in 1.17

Sustainability risk: 9.0 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	3.5	Upbound is the creator and primary maintainer and the graduation post names no other maintainer organisation; 3,000+ contributors from 480+ companies are vendor-reported
Backer health	2	Upbound is venture backed with $69 million raised; the CNCF hosts the project; no sponsor list read
Licence-change risk	1.5	Apache 2.0 held by the CNCF; the risk sits in the providers, where Upbound gated Official Providers in 2025 and tied them to UXP
Abandonment signs	0.5	Quarterly releases kept, calendar published to 2027, CNCF Graduated in 2025
Security response	1.5	Two security audits before graduation; 2.4 hardened garbage collection; maintenance is best effort with no response SLA

Technical lock-in: 11.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	2.5	Kubernetes YAML, but XRDs, Compositions and functions are Crossplane specific
Export path	3	No documented path to another IaC tool; managed resources can be left in place when a claim is deleted
Stack coupling	3	Requires a Kubernetes control plane
Hardware / cloud coupling	0.5	Any cluster, offline capable; the engine needs no Upbound account
Skills and tooling coupling	2.5	Kubernetes skills are common; composition and function authoring skills are scarce

Integrator fit: 13.0 / 20

Criterion	Score	Basis
Partner programme openness	2.5	Foundation project with open downloads; Upbound's partner terms not found and its Official Providers are gated
Multi-tenancy and self-service	4	Namespaced composite resources in v2 give per-tenant APIs under Kubernetes RBAC
API and infrastructure-as-code	4.5	The Kubernetes API is the whole interface; any client and any GitOps tool works
Skills and certification	2	No certification found

AI leverage: 2.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI code and plan generation	0	0	0	2018: None
AI platform stack	0	0	0	2018: None
AI-assisted operations	0	0	0	2018: None
Agent openness	1	2	2	2020: 1.0: every object behind a stable Kubernetes API that any agent can drive; no official MCP server verified

Year by year: 2018: 1 · 2019: 1 · 2020: 2 · 2021: 2 · 2022: 2 · 2023: 2 · 2024: 2 · 2025: 2 · 2026: 2

AI say-do, 2023 to 2026: 2 AI items announced; 0 GA, 0 still preview, 2 pending, 0 dropped. UXP 2.0's AI-enhanced operations and the Upbound Marketplace MCP server were announced without a stated status; neither was read from a primary page.

The project's own position is that a Kubernetes API is the agent interface, and it ships no AI feature. Upbound announces AI insights and an MCP server for its distribution, but no status, date or documentation page could be verified in this pass.

Reading

Crossplane scores highest in this group on orchestration and self-service because the product is a Kubernetes API that platform teams expose to tenants, and it is the only one that repairs drift continuously rather than reporting it. It scores lower on state and planning because there is no plan or diff before a change reaches the cluster, and on breadth because the on-prem hypervisor providers are maintained by individuals. The cadence record is the best in the group, with dates published two years ahead and kept. Check your dependence on Upbound before adopting: the Official Providers for the big clouds are free only in their latest version and, from UXP 2.0, run only on Upbound's distribution.

Open questions and items to re-score

The first release date and the exact years of pre-2025 releases (GitHub pages show day and month only).
Full contents of v2.1 to v2.3.
Whether the community vSphere, Proxmox VE and Nutanix providers have more than one maintainer.
UXP AI features and the Upbound Marketplace MCP server: status, date and documentation.
Upbound Official Provider list prices and partner programme.
Pipeline inspector and provider deletion protection are alpha; re-score when GA.